About Java Bytecode, native binaries & security (short Grype benchmark)

Intro

We are currently working on the following topics :

• Native Docker images delivery through Github Actions, on various registries (mainly GHCR.io and Docker Hub)
• Java native experience : migration to Spring Boot Native & Quarkus experimentations
• Security for our Images Continuous Deployment pipeline

Security

For our source code & dependencies, we are applying security strategy thanks to Dependabot :

Dependency management automation with Dependabot

SALES for opt-nc Apr 7 1 min read

#github #security #maintenance #java

...and GitHub Advanced Security for some repositories.

Controlling Docker images releases

More and more we release and rely on an ever growing set of Docker images.
To make short, as Software Developers and DEVOPS engineers, the ones that interest us currently are :

• The images we rely on
• The image we build ourselves (on top of previous ones)

What we want need to be able to do is : to be able to control the security level of the images we are building...

And not release them if they do not reach the expected level of security, depending of the target service.

As all services do not have the same criticity, vulnerabilities level may have different impacts on runtime security governance.

Experimentation and solutions

Fortunately anchore provides a set of ready to use tools that helps... a lot :

• grype (vulnerability scanner for container images and filesystems)
• syft (CLI tool and library for generating a Software Bill of Materials from container images and filesystems)
• grype as a Anchore GitHub Action :

So you can easily protect your Continuous Delivery pipeline thanks to the severity-cutoff :

Bytecode vs. native impact on security

We wanted to give a quick look at if - and so how - native strategy impacts security, discover the grype output below:

Resources

• grype on GitHub
• grype Feature request : Optional External Data Source Reference for Maven Packages

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin